Probes can be deployed at one or more locations of a communication network to gather network data that can be analyzed for monitoring captured network traffic data. The probes can be physical probes that are physically deployed at one or more locations of the communications network, or virtual probes that can be deployed by a remote computer. Virtual probes can capture vast amounts of network traffic data due to the relative ease of deployment and reduced access restrictions relative to that of physical probes. It can become impractical, burdensome, or impossible to monitor or analyze the captured data.
Methods have been developed that use light-weight session tracking (LST) in which a portion of the captured data is selected for analysis to lighten the monitoring and analyzing loads. However, the selection is performed manually. Accordingly, there is a need to automatically select data from the captured network traffic data for monitoring and/or analysis.